CVE-2026-119032

The Schema & Structured Data for WP & AMP WordPress plugin, in versions before 1.70 , is vulnerable to Authenticated Arbitrary Post Modification . The root cause is a failure to verify if an importing user has permission to edit posts specified in a settings backup , coupled with a lack of restri...

WordPress Schema & Structured Data for WP & AMP plugin < 1.70 - Authenticated Arbitrary Post Modification vulnerability

Authenticated Arbitrary Post Modification vulnerability discovered by Raphael P. Cigana in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.70...

CVE-2026-119032 Schema & Structured Data for WP & AMP < 1.70 - Authenticated Arbitrary Post Modification via Backup Import

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data...

WordPress Fiber Admin plugin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification vulnerability

Unauthenticated Arbitrary Post and Term Order Modification vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Fiber Admin versions 4.0.1...

WordPress Mapster WP Maps plugin < 2.0.6 - Unauthenticated Arbitrary Post Modification vulnerability

Unauthenticated Arbitrary Post Modification vulnerability discovered by Usama Arshad in WordPress Plugin Mapster WP Maps versions 2.0.6...

CVE-2026-118638

The Mapster WP Maps WordPress plugin versions before 2.0.6 is vulnerable to an unauthenticated arbitrary post modification vulnerability. The root cause is a missing authorization check on a REST API route used to write post data (specifically identified in some records as the save-mapmaker route...

CVE-2026-118638 Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

CVE-2026-118638 Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

WordPress Modern Events Calendar Lite plugin < 7.36.4 - Subscriber+ Arbitrary Post Modification vulnerability

Subscriber+ Arbitrary Post Modification vulnerability discovered by Nguyen Duc Thinh in WordPress Plugin Modern Events Calendar Lite versions 7.36.4...

CVE-2026-118101 BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages,...

CVE-2026-118101

The BuddyForms WordPress plugin, in versions prior to 2.10.1 , is vulnerable to an arbitrary post modification issue due to a missing authorization check. The plugin fails to verify if a user editing an existing entry is the actual author of the target post. This allows users with form edit acces...

CVE-2026-118101 BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages,...

WordPress BuddyForms plugin < 2.10.1 - Subscriber+ Arbitrary Post Modification vulnerability

Subscriber+ Arbitrary Post Modification vulnerability discovered by Furkan Arslan in WordPress Plugin BuddyForms versions 2.10.1...

WordPress AI Engine plugin < 3.7.9 - Editor+ Arbitrary Post Modification vulnerability

Editor+ Arbitrary Post Modification vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin AI Engine versions 3.7.9...

CVE-2026-111041

The AI Engine WordPress plugin, in versions prior to 3.7.9 , contains an authorization vulnerability in its AI media management functionality. Specifically, the plugin fails to verify if a user owns or is authorized to edit a targeted object during certain actions, such as update_media_metadata a...

CVE-2026-111041 AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media

The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including...

CVE-2026-111041 AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media

The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including...

WordPress Bricks Builder theme <= 2.4.2 - Unauthenticated Arbitrary Post Modification via Form Submission vulnerability

Unauthenticated Arbitrary Post Modification via Form Submission vulnerability discovered by Patchstack in WordPress Theme Bricks Builder versions = 2.4.2...

CVE-2026-96532

The Testimonials Widget WordPress plugin, versions through 4.0.4 , is vulnerable to an unauthenticated arbitrary post update vulnerability. The root cause is a failure to perform capability or ownership checks when processing the plugin's front-end testimonial submission form. This flaw allows un...

EUVD-2026-87540

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing...